fastzcup[.]com

The domain fastzcup.com has been identified as a credential harvesting platform specifically targeting users of the Zcash cryptocurrency wallet. Analysis indicates this domain operated as a fake login portal designed to capture sensitive authentication details, including private keys and wallet credentials. As of the latest verification, the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Technical indicators reveal that fastzcup.com was flagged by 4 of 95 security vendors on VirusTotal, reflecting an elevated but not unanimous detection rate. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis shows the domain resolved to the IP address 188.114.97.3, which has been linked to other transient phishing campaigns. The domain appears on one security blocklist, further corroborating its malicious classification. No additional subdomains or associated infrastructure were identified during the investigation. Current status confirms fastzcup.com is offline, though the registrar and underlying infrastructure may still pose risks for future malicious activity. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Users who accessed the domain should immediately revoke any exposed credentials, monitor associated accounts for unauthorized activity, and consider migrating to new wallet addresses if private keys were entered. Proactive monitoring of registrar activity from NICENIC INTERNATIONAL GROUP CO., LIMITED is recommended, as domains registered through this entity have demonstrated a pattern of rapid deployment and takedown in phishing operations.